Privatebin plugin

[rfc2119]

This is still a WIP. The following is a "draft" for me of what I have found and should be doing in the plugin. This implements #135

usage and scenario

• create a new paste
  /msg bitbot !paste <content>

• delete a paste
  /msg bitbot !paste --delete <delete_token>

see sample for sample server-side configuration file for privatebin (and for more ideas, like url-shortner)

the following sequence diagram represents the creation of a new paste:

encryption format

from here; the following request was sent with key 7MqznSyqHVx9VwNWfHRi6PLsr322eBY4Fnkx45tFV1gR

{
  "adata": [                                // auth data
    [
      "Yu5ECsseuJ07M2QBfdf3bA==",           // base64(cipher_iv); getRandomBytes(16) default
      "kvDZJC6IahU=",                       // base64(kdf_salt); getRandomBytes(8) default
      100000,                               // pbkdf_iterations; default
      256,                                  // pbkdf_keysize; default
      128,                                  // cipher_tag_size (wtf ?); default
      "aes",                                // cipher_algo; default
      "gcm",                                // cipher_mode; default
      "zlib"                                // compression_type; default
    ],
    "plaintext",                            // format of the paste - "plaintext" or "syntaxhighlighting" or "markdown"

    0,                                      // open-discussion flag
    0                                       // burn-after-reading flag (0 or 1)
  ],
  "meta": {
    "expire": "1week"
  },
  "v": 2,                                               // schema version
  "ct": "aVKpZWtKmTJKis5S6nYEL1rdxyPbHYFclHV3E6Kq99Tb"  // cipher text
}

A prompt for password shows up on wrong encryption keys. Also, for ducks sake, It took me a while to figure out that the key is encoded in base58. Here's the relevant code:

me.getPasteKey = function()
        {
            if (symmetricKey === null) {
                let newKey = window.location.hash.substring(1);
                if (newKey === '') {
                    throw 'no encryption key given';
                }

                // Some web 2.0 services and redirectors add data AFTER the anchor
                // (such as &utm_source=...). We will strip any additional data.
                let ampersandPos = newKey.indexOf('&');
                if (ampersandPos > -1)
                {
                    newKey = newKey.substring(0, ampersandPos);
                }

                // version 2 uses base58, version 1 uses base64 without decoding
                try {
                    // base58 encode strips NULL bytes at the beginning of the
                    // string, so we re-add them if necessary
                    symmetricKey = CryptTool.base58decode(newKey).padStart(32, '\u0000');
                } catch(e) {
                    symmetricKey = newKey;
                }
            }

            return symmetricKey;
        };

Key derivation (PBKDF2)

Since passwords and keys are usually too short to be usable for encryption, it is common practice to use salted key derivation to turn such low entropy input into the actual key to use during en/decryption.

kdf_salt = random(8) # 8 bytes
kdf_iterations = 100000 # was 10000 before PrivateBin version 1.3
kdf_keysize = 256 # bits of resulting kdf_key

kdf_key = PBKDF2_HMAC_SHA256(kdf_keysize, kdf_salt, paste_password)

where `paste_password i
The encrypted text is then:

cipher_algo = "aes"
cipher_mode = "gcm" # was "ccm" before PrivateBin version 1.0
cipher_iv = random(16) # 128 bit
cipher_tag_size = 128

cipher_text = cipher(AES(kdf_key), GCM(iv, paste_meta), paste_blob)

generating paste_password

If paste_password is an empty string:

paste_passphrase = random(32) # 32 bytes

if a paste_password has been specified:

paste_passphrase = random(32) + paste_password

Processing of the paste_data, if compression is enabled (the default):

paste_blob = zlib.compress(paste_data)

repsonse

{
  "status": 0,
  "id": "8d18870b7b9ae766",
  "url": "/?8d18870b7b9ae766",
  "deletetoken": "61927f5710f04c399533fedcad07f5b5e13fc79e6e8df4065bc71217d1f7edad"
}

todo

• switch to a db instead of "file-less" configuration
• enable ability to delete
• enable paste cloning
  see more at this comment

[bbriggs]

I love this. Let's fast track it.

[rfc2119]

A very bare-bones version is up! Here's a to-do list:

• add a check for compression type in the request, and support for zlib if it was requested (it seems the vanillia package compress/zlib is not compbatiable with the one at privatebin). Here's one particular hint by elrido
• instruct the server to derive a standard-length IV (so that we can use NewGCM directly)
• fully support privatebin API
• only fetch paste content and encrypt that
• user should be able to change privatebin options (e.g "burn after reading" flag: /msg bitbot !paste -expires 7 -burn true )
• (related to above) add an option to send the reply to a channel of choice (example: /msg bitbot !paste -channel #main )
• remove hard-coded strings
• support file attachement and paste linking
• the plugin should be activated on a private query to bitbot (done in eb6261c)
• any other TODO in bitbot/paste.go

[m-242]

This needs formatting, use go fmt $file on the files.
Also, this might interest you.